Chaos Labs
Chaos Labs builds risk oracles — systems that update lending and trading parameters automatically from market data. It was Aave's primary risk manager from November 2022 until it left in April 2026, and served as Venus Protocol's risk manager until early 2026. It works with GMX on market risk and runs USDC vaults in Kraken's DeFi Earn programme.
Suits: Protocols and depositors that want parameters updated continuously rather than by periodic governance votes
How this score was reached
Every firm starts at 10.0. The lines below are the only things that move it: each event on the ledger after credits for the response, and the two firm-level checks. Nothing on the ledger costs this firm points. That is an absence of documented failures, not proof of skill.
| Start | 10.0 |
| 10 Mar 2026 — wstETH CAPO oracle misconfiguration on Aave | 0.0 |
| 10 Oct 2025 — Oracle deviations on Venus during the 10 October 2025 crash | 0.0 |
| Public risk methodology | 0.0 |
| At least one year of documented mandates | 0.0 |
| Score | 10.0 |
|---|
The facts, with sources
A value with no source does not count toward the score. Where a fact could not be found it reads “not published” and is scored by the published rule for missing data.
| Criterion | Value | Source | Checked |
|---|---|---|---|
| Public risk methodology | PublishedDescribes how its risk oracles monitor risk indicators and push bounded parameter updates on-chain. | chaoslabs.xyz ↗ | 21 Sept 2026 |
| First documented mandate or vault | 1 Nov 2022Joined the Aave DAO as risk-management service provider in November 2022 (month as stated by Chaos Labs) | governance.aave.com ↗ | 21 Sept 2026 |
| Mandate — Aave | Primary risk manager (V2, V3, GHO)November 2022 – May 2026; 30-day offboarding from 8 April 2026 | governance.aave.com ↗ | 21 Sept 2026 |
| Mandate — Venus | Risk manager and risk oraclesUntil early 2026 | community.venus.io ↗ | 21 Sept 2026 |
| Mandate — GMX | Risk oracles and market risk modellingSince 2024 | gov.gmx.io ↗ | 21 Sept 2026 |
| Mandate — Kraken DeFi Earn | Vault risk manager for USDC vaults, alongside SentoraSince January 2026 | theblock.co ↗ | 21 Sept 2026 |
| Incidents on the ledger | 2Each listed below with its sources | — | 21 Sept 2026 |
On the record
- Published its post-mortem on the Aave wstETH CAPO incident the same day, naming its own off-chain process as the source of the misconfiguration.
- Both events on its ledger were explained within four days and followed by confirmed payouts to affected users.
Against it
- The CAPO misconfiguration of 10 March 2026 cost Aave users about 512 ETH (≈$1.02M) through erroneous liquidations.
- The 10 October 2025 crash left about $1.38M of bad debt on Venus, largely from an oracle price deviation Chaos Labs attributed to Chainlink's CAKE feed — a reading Chainlink publicly disputed.
- Delegates noted the Aave reimbursement came without a public per-user accounting, and one payment was reported about 20 WETH short.
Chaos Labs on the ledger
- 0.0
wstETH CAPO oracle misconfiguration on Aave
Role: Primary risk manager for Aave; operated the CAPO risk oracle
- Loss or bad debt
- $1.02M−2.0512.48 ETH of losses to users (382.76 ETH oracle profit captured by liquidators + 129.72 ETH liquidation bonus) per the Aave reimbursement proposal, converted at the CoinGecko ETH/USD price of $1,992.98 on 10 March 2026. The protocol took no bad debt.
- Response
- ✓ Post-mortem the same day +1.0✓ Depositors paid +1.0— No ignored public warning documented
Posted a post-mortem the same day: a snapshot ratio and timestamp set out of step pushed the wstETH exchange-rate cap about 2.85% below market, triggering 10,938 wstETH of E-Mode liquidations across 34 accounts. Borrows were capped and the ratios resynchronised through the Risk Steward.
The Aave DAO refunded affected users from its treasury after recovering part of the liquidators' gains; the AIP was executed and funds distributed by 1 April 2026. Delegates noted there was no public per-user accounting and one payment was reported about 20 WETH short.
Primary sourcePost-Mortem: Exchange Rate Misalignment on wstETH Core and Prime Instances — Chaos Labs ↗Payout record ↗
- 0.0
Oracle deviations on Venus during the 10 October 2025 crash
Role: Risk manager for Venus Protocol
- Loss or bad debt
- $1.38M−2.0About $1.38M of bad debt in Chaos Labs' own analysis (Venus later put it at ~$1.17M at 31 October balances). Separately, borrowers liquidated during the WBETH depeg window were compensated.
- Response
- ✓ Post-mortem in 4 days +1.0✓ Depositors paid +1.0— No ignored public warning documented
Published a market-volatility update four days after the crash with liquidation volumes, the bad debt and the CAKE oracle deviation it identified (Chainlink disputed that reading in the same thread), then a per-user repayment analysis for WBETH holders.
The first wave of compensation to users liquidated during the WBETH depeg was executed on 27 October 2025, priced on Chaos Labs' analysis of the depeg window, and a second wave followed. Repayment of the remaining bad debt from the Venus Risk Fund was proposed on 6 November 2025.
Primary sourceChaos Labs — Market Volatility Risk Update, 14 October 2025 ↗Payout record ↗
◆ Not on this ledger, and why
The Kelp rsETH bridge exploit of 18 April 2026 is not on Chaos Labs' ledger. It had announced its departure from Aave on 6 April, and its 8 April offboarding plan rotated the manual Risk Steward keys to Aave Labs and LlamaRisk; the event is recorded against LlamaRisk, which held the parameter controls that day.
A $2.15M bad-debt event on Venus on 15 March 2026 is not on this ledger either: by then Venus had engaged Allez Labs as its risk manager, and Allez Labs wrote that post-mortem.